thehardwarestore.ai

pycdc/pycdas is a C++11 command-line toolchain for reverse engineering CPython bytecode. pycdc decompiles compiled .pyc files back into human-readable Python source; pycdas emits a detailed bytecode disassembly (with options like --show-caches and --pycode-extra). Version coverage spans Python 1.0 (1994) through 3.13, with the correct opcode semantics selected from the .pyc magic number at load time. The entry points are pycdc.cpp and pycdas.cpp, which are thin CLIs over the pycxx static library that owns marshal-format parsing (pyc_object.cpp, pyc_numeric.cpp, pyc_string.cpp, pyc_sequence.cpp), code-object extraction (pyc_code.cpp), and interpreter version detection (pyc_module.cpp). It also supports decompiling raw marshalled code objects via -c -v <version>. Decompilation loads the code object and interprets its bytecode on a virtual stack machine (FastStack with history snapshots) inside ASTree.cpp, reconstructing structured control flow (loops, try/except, comprehensions, with-blocks) and lowering it into an ASTNode tree for source emission. Opcode semantics are maintained as an X-macro include (bytecode_ops.inl) with explicit version ranges, and per-version opcode-name maps live in bytes/python_*_*.cpp. The module boundaries cleanly separate binary I/O (endian-aware PycBuffer/PycFile streams), object marshalling, disassembly, AST construction, and printing - although the decompiler core itself is a dense, version-conditional megafile. QA is the project's strongest asset. Roughly 200 .pyc fixtures spanning every Python major release (plus an xfail set for known-unfixed cases) are checked by tests/run_tests.py, which compares decompiler output to expected output as token streams rather than exact text - tolerating cosmetic whitespace differences while still catching semantic regressions. Linux and Windows CI run the suite, and scripts/pymultic, Dockerfile.pybuild, and a collection of Autoconf modernization patches make it possible to rebuild ancient CPython releases to regenerate those fixtures. Recent commits cover Python 3.13 opcode support, and the repository is actively maintained. Caveats: the 25-year version matrix forces heavily conditional decompilation logic, some mutable global state exists in ASTree, and unknown or future-modified opcodes degrade to partial output with an 'Unsupported opcode' warning. For its niche, it is the most complete open-source CPython decompiler available.

Speakeasy is a Windows malware emulation framework developed by Mandiant (FireEye). It executes Windows PE executables, DLLs, drivers, and shellcode in a fully emulated Windows environment, intercepting API calls via a large set of stub handlers that model kernel32, ntdll, ws2_32, user32, ntoskrnl, and many other DLLs. The emulation is powered by Unicorn (CPU emulation) and Capstone (disassembly). It provides both a CLI tool (`speakeasy`) and a Python library (`Speakeasy` class) for programmatic use. Key features include: user-mode and kernel-mode emulation, GDB remote debugging support, configurable file system, registry, network, and process models, SEH handling, API hammering detection, and structured JSON reports with profiling events, memory captures, and artifact deduplication. The architecture is a monolithic Python package with a core emulator class, platform-specific emulators (Win32Emulator, WinKernelEmulator), and a large set of API handler modules organized by DLL. Dependencies include unicorn, capstone, pefile, pydantic, rich, and pyelftools. The project is primarily used for automated malware analysis and reverse engineering.

ONO is an Android Xposed module that modifies and enhances the QQ messaging application (Tencent). It provides a broad set of features including custom sticker panels, message encryption, anti-revoke, developer tools (packet inspection, cookie retrieval), UI tweaks (bubble redirect, profile card menu), and entertainment hooks (fake group owner, sport step spoofing). The module supports both legacy Xposed (API 51–99) and modern LSPosed (libxposed API 100) frameworks, with a dual-entry architecture that unifies startup through a shared `UnifiedEntryPoint` and `StartupRoutine`. Internally, it uses a sophisticated hook item framework based on annotations and a KSP annotation processor to automatically register hook classes. The codebase is heavily reliant on reflection and reverse-engineering of QQ's internal classes, making it tightly coupled to specific QQ versions, but the core utilities (reflection helpers, configuration management, protocol building) are well-crafted and potentially reusable in other Android hooking projects. The project is actively maintained with frequent commits, responsive issue triage, and a comprehensive build system using Gradle convention plugins.

ExplorerPatcher is a Windows shell customization utility that operates by DLL injection and API hooking inside explorer.exe and related shell processes. In production it ships a patcher DLL (loaded via a dxgi.dll stub renamed into the Explorer directory), a settings GUI (ep_gui.dll, launched via rundll32 dxgi.dll,ZZGUI), an installer/uninstaller (ep_setup.exe), a WebView2-based weather COM host, an Alt+Tab replacement module, and a Start menu patching module (ep_startmenu). At runtime it reads feature toggles from HKEY_CURRENT_USER\Software\ExplorerPatcher, hooks undocumented internal COM interfaces and WinRT activation factories, applies inline machine-code patches and vtable replacements, and restores Windows 10 taskbar, Start menu, context menus, and Alt+Tab behaviors on Windows 11. It also downloads symbols from Microsoft symbol servers and uses byte-pattern scanning to resolve version-specific function offsets. Architecturally this is a suite of loosely coordinated native Windows modules rather than a monolith: the core patcher coordinates them, a chainloader (ep_extra.dll) discovers and loads ep_extra_*.dll plugins, and everything is versioned and bundled by the setup program using AES-encrypted embedded ZIP resources. External dependencies include KNSoft.SlimDetours for hooking, Microsoft WIL, WebView2, zlib, libvalinet, SimpleWindowSwitcher, plus git submodules and a separately downloaded ep_taskbar.dll. The code is heavily build-specific, with x64/ARM64/IA-32 branches and fallback pattern sets for Windows 10/11 builds from 22000 through current 26100+ servicing builds. The craftsmanship is genuinely notable for a reverse-engineering project: ARM64 instruction encode/decode helpers, multi-stage pattern scanners with gap and bitmask variants, SlimDetours transactional IAT hitching, and clean reusable header templates for allocation policy strings and COM ref-counting. The maintenance burden is inherent and huge — every Windows cumulative update risks breaking hardcoded offsets, and the code carries architectural debt from this fight: monumental C files (dllmain.c exceeds 4000 lines), heavy preprocessor branching, dead #if 0 blocks, and no automated test suite. It is not a data/research repository despite containing bundled .pri and .mui localization assets; those are deployment resources, not data artifacts. Despite its fragility, the project tracks Windows updates aggressively (weekly fixes per the changelog) and delivers a working, widely deployed product.

Apktool is a command-line tool for reverse engineering Android APK files. It decodes binary resources (resources.arsc, AndroidManifest.xml, 9-patch images) back to nearly original form, disassembles DEX bytecode into Smali assembly using baksmali, and provides a rebuild pipeline that reassembles and signs the APK via aapt2 and apksigner. The tool manages Android framework APK installations to resolve resource references during decoding. The architecture is a multi-module Gradle project: a core library (apktool-lib) exposing programmatic APIs (ApkDecoder, ApkBuilder, ResTable, Framework), and a CLI wrapper (apktool-cli) that provides commands like decode, build, install-framework, and list-frameworks. Supporting libraries (brut.j.util, brut.j.dir, brut.j.yaml, brut.j.xml) handle I/O, directory abstraction, YAML metadata, and XML serialization. External dependencies include Google's aapt2 binary (bundled per platform) and the smali/baksmali libraries for DEX compilation. The codebase demonstrates deep knowledge of Android binary formats, with custom parsers for chunked resource tables, binary XML, and resource qualifiers, and includes extensive regression tests covering edge cases and security vulnerabilities.

NapCatQQ is a headless QQ bot framework that integrates with the NTQQ (New Technology QQ) desktop client via native injection and reverse-engineered protocol internals. It implements the OneBot v11 standard protocol, providing HTTP, WebSocket, and SSE network adapters for external bot control, along with a comprehensive web-based management interface (WebUI) for configuration, monitoring, file management, terminal access, and plugin management. The system is organized as a monorepo with over 30 packages, including core QQ protocol interaction (napcat-core), OneBot adapter (napcat-onebot), WebUI backend (Express) and frontend (React), a plugin system, RPC library, protobuf runtime, image size detection, PTY terminal support, and database decryption tools. The architecture is modular but tightly coupled to the NTQQ native wrapper, which is loaded via platform-specific binaries. Key entry points include the shell loader (napcat-shell/napcat.ts) for process management, the framework bootstrap (napcat-framework/napcat.ts), the OneBot adapter initialization (napcat-onebot/index.ts), and the WebUI Express server (napcat-webui-backend/index.ts). Data flows involve receiving QQ events through native listeners, converting them to OneBot events, and dispatching to configured network adapters. Outgoing actions are translated to QQ internal API calls via packet transformers and highway file uploaders. External dependencies include the NTQQ desktop client (required runtime), FFmpeg for media processing, platform-specific native binaries for packet handling and PTY, and various Node.js packages (Express, React, TypeBox, etc.). The project is actively maintained but carries inherent fragility due to its reliance on reverse-engineered QQ internals that may change with QQ updates.

Kaitai Struct is an umbrella project that provides a declarative language for describing binary data structures and a compiler to generate parser code in multiple target languages. The repository coordinates submodules for the compiler, runtimes for various languages (Java, Python, Ruby, etc.), format definitions, visualizer, tests, benchmarks, and documentation. Users describe a format in a .ksy file, compile it with the kaitai-struct-compiler to generate language-specific parser code, and use the corresponding runtime to parse binary data. The project includes CI workflows for building the compiler and publishing artifacts, and maintains a collection of ready-to-use format descriptions.

ROPgadget is a Python CLI security tool that statically scans executable binaries for ROP, JOP, and SYS gadgets. It discovers architecture-specific byte patterns (x86/x64, ARM/ARM64, MIPS, PowerPC, SPARC, RISC-V), disassembles candidate regions with Capstone, and outputs address/instruction listings. It supports ELF, PE, Mach-O, raw, and universal/fat binaries, and offers filtering by mnemonic, regex, bad bytes, address ranges, and call-preceded gadgets. For x86/x64 ELF targets it can also generate a Python exploit script that chains gadgets into a ROP payload.

This repository implements a dual-console emulator targeting PlayStation 3 (RPCS3) and PlayStation 4 (RPCSX/Orbis). The codebase is a large C++ project with a modular architecture: kernel emulation layers for both consoles (syscalls, threads, memory management), CPU emulation (PPU/SPU for PS3, GCN for PS4), GPU emulation (RSX for PS3 with OpenGL/Vulkan backends, GCN shader compiler for PS4), audio backends (Cubeb, FAudio, ALSA), input handlers (DS3, DS4, XInput, PS Move, etc.), network emulation (RPCN, UPnP), and a custom overlay UI system. The project is under active development with frequent commits, though many PS3 firmware modules remain as stubs or placeholders. The architecture separates PS3 and PS4 emulation into distinct directories (`rpcs3/` and `rpcsx/`), sharing a common utility library (`rx/`) that provides synchronization primitives, memory management, and debugging tools. The GPU emulation is particularly sophisticated, featuring a custom shader intermediate representation (IR) for AMD GCN instructions with optimization passes and SPIR-V/GLSL backends. The codebase also includes a comprehensive serialization framework for savestates, a YAML-based configuration system, and a texture cache predictor for GPU performance. Key entry points include the main emulator executables (built from `rpcs3/` and `rpcsx/`), the kernel syscall handlers in `kernel/orbis/` and `kernel/cellos/`, the GPU renderers in `rpcs3/Emu/RSX/` and `rpcsx/gpu/`, and the PS3 firmware HLE modules in `ps3fw/`. External dependencies include Vulkan, OpenGL, FFmpeg, WolfSSL, SDL2, libusb, and several audio libraries. The project is primarily a software application for console emulation, with significant reverse-engineering and research components.

This is a Node.js CLI application (Docker containerized) that automatically logs into the Epic Games Store using device code authentication (OAuth2 device grant), discovers currently free games (weekly promotions and general store discounts), validates ownership via Epic's GraphQL APIs, and sends actionable checkout links to the user through a variety of notification channels (email, Discord, Telegram, Pushover, Gotify, Slack, Home Assistant, Bark, Ntfy, Apprise, webhook, and local browser open). The application uses Puppeteer with a stealth plugin to simulate a browser session for cookie management and authenticated API calls. It runs on a configurable cron schedule, with optional run-on-startup and one-shot modes. It includes a lightweight Express web server to handle device code login redirects and optionally exposes itself via localtunnel for remote accessibility. Configuration is JSON/JSON5 with full class-validator based schema validation and environment variable fallbacks.

Bluebox is a library and agent framework for reverse engineering web applications by monitoring browser interactions via Chrome DevTools Protocol (CDP). It captures network requests, DOM snapshots, storage changes, and user interactions into JSONL files, then uses LLM-driven agents to discover reusable automation routines (parameterized workflows) that can navigate, fetch, click, type, and extract structured data from live websites. The system includes a conversational agent (BlueBoxAgent) that searches a routine index and falls back to an AI browser agent, a GuideAgent for interactive routine creation, and a PrincipalInvestigator orchestrator that runs parallel specialist agents (network, DOM, storage, UI) to build routine catalogs from captured sessions. Architecturally, Bluebox is a modular Python application with clear separation: CDP monitors and session management, Pydantic data models for routines and events, abstract base classes for agents and data loaders, LLM vendor clients (OpenAI, Anthropic), a workspace abstraction for artifact management, and CLI/HTTP entry points. The SDK provides high-level methods (monitor_browser, discover_routine, execute_routine) and the package ships with example routines for real-world sites (Amtrak, Polymarket, Massachusetts corporate search). While primarily an application/library, Bluebox has a strong data pipeline character: it ingests raw CDP events, transforms them through data loaders and vectorstores, and produces structured routine definitions. The benchmark framework evaluates routine quality with deterministic and LLM-based tests. The codebase demonstrates high craftsmanship with reusable patterns (agent tool decorator, workspace abstraction, sandboxed execution, data loader interface) and extensive unit tests, though some specialist agents are marked as beta and the orchestration pipeline is complex.

InjectionIII is a macOS menu bar application that enables hot reloading of Swift, Objective-C, and C++ code in iOS simulators and devices. It works by watching for source file changes, recompiling them using Xcode build logs, and dynamically loading the resulting dylib into the running app using techniques like interposing, vtable patching, and Objective-C swizzling. The app consists of a daemon with a file watcher and injection server, while the client-side code (bundled as injection bundles or via the HotReloading Swift package) handles compilation and injection. It supports standalone injection without the app running, injection on real devices, and integration with SwiftUI. The codebase is mature and actively maintained, though it contains legacy C/ObjC components and is tightly coupled to Xcode build log parsing.

This repository is a bit-exact decompilation of Touhou Koumakyou ~ the Embodiment of Scarlet Devil (TH06) for Windows, aiming to reconstruct the original executable from scratch using reverse engineering. It is primarily an application—a full game reimplementation with subsystems for graphics (Direct3D8), audio (DirectSound, MIDI), input (DirectInput), enemy scripting (ECL), sprite animations (ANM), replay recording, menu UI, and more. The build system uses MSVC 7.0 and DirectX 8.0 SDK, orchestrated by Python scripts and Ghidra for analysis and comparison. While the core purpose is binary-matching reconstruction, the project also functions as a research repository for understanding the game's internals, with extensive mapping data (CSV files) and Ghidra export scripts. The codebase is large, tightly coupled via global singletons, but contains several self-contained reusable components such as the Chain callback system, PBG3 archive parser, DirectSound wrapper, MIDI player, and a standalone PE file parser (pefile.py). Active development and CI indicate ongoing work to complete the decompilation.

DWARF Explorer is a cross-platform GUI utility for visualizing DWARF debugging information in executable files. Built on PyQt6, pyelftools, and filebytes, it allows users to open ELF, Mach-O, PE, WASM, and ar files to browse their DWARF debug information tree. The application provides views for DIEs (Debugging Information Entries), attributes, references, and includes specialized tools for analyzing locals at addresses, function maps, data sections, frame information, and unwind data. The architecture follows a modular design with clear separation between the GUI layer (PyQt6-based interface in __main__.py and ui.py) and the DWARF analysis logic. Core functionality includes parsing various binary formats via formats.py, building and navigating the DIE tree through tree.py and die.py, and performing specialized analyses using utilities in dwarfutil.py, locs.py, and other modules. The application supports features like following DIE references, searching by conditions, highlighting DIEs, and exporting C skeletons. Key strengths include robust error handling with crash reporting, support for multiple binary formats and DWARF versions (including experimental v1 support), and thoughtful UI design with keyboard navigation, bookmarking, and detailed views. The code demonstrates good practices in separating concerns, with reusable components like the Mach-O unwind parser that could be extracted for use in other projects.

FreeMote is a Windows-oriented .NET Framework 4.8 toolchain for reverse-engineering, decompiling, converting, rendering, and rebuilding E-mote (EMT) PSB game asset packages. It is primarily an application suite rather than a data/research project: five CLI tools (EmtConvert, PsbDecompile, PsBuild, EmtMake, FontBuilder-related commands) plus a WPF viewer provide user-facing workflows, while the core libraries FreeMote, FreeMote.Psb, and FreeMote.PsBuild implement binary parsing, encryption, plugin dispatch, compilation/decompilation, and platform conversion. The architecture is modular: FreeMote handles low-level container and crypto primitives, FreeMote.Psb provides the PSB object model and plugin interfaces, FreeMote.PsBuild handles JSON/PSB conversion and E-mote project generation, and FreeMote.Plugins supplies compressors, image/audio codecs, and shell handlers through MEF composition. The primary data flow is file-in/file-out: encrypted or shell-wrapped PSB containers are opened through FreeMount plugin composition, decrypted or unpacked into an in-memory PSB object graph, decompiled to JSON plus extracted resources, then optionally recompiled, re-encrypted, and packed back into shells. The reverse pipeline also supports building PSB from JSON, generating bitmap fonts, porting between Kirikiri/Windows/common/console specifications, converting motion PSB into MMO editor projects, and extracting textures/audio from archives. The code embodies deep reverse-engineering knowledge: PSB versions 1-4, trie-compressed name tables, XorShift128/MT19937 cipher handling, MDF/LZ4/Zlib shells, ASTC/BC7/DXT/TLG pixel formats, and console-specific texture swizzling. Although the repo contains research-grade format analysis, its dominant character is an application toolkit for game modding. It is actively maintained with CI packaging, tests, and a plugin ecosystem, but carries medium technical drift: legacy .NET Framework and System.Drawing dependencies, Direct3D9 interop in the viewer, reliance on external executables for some audio/image encoders, hard-coded platform heuristics, and a large monolithic Psb.cs with TODO debt. The most reusable assets are self-contained texture utilities and the generic plugin/composition pattern, not the tightly coupled PSB-specific pipeline components.

This repository contains otx, a Mach-O disassembler for macOS that provides both a graphical user interface and a command-line tool. It specializes in disassembling Mach-O executables (supporting x86_64 and arm64 architectures) and enhancing the output with semantic information such as Objective-C method names, demangled C++ and Swift symbols, and annotations for literal pools and data references. The application also detects and repairs obfuscated NOP sequences (an anti-disassembly technique) for x86_64 binaries. The architecture features a modular processor hierarchy where a base `ExeProcessor` class is extended for specific architectures (e.g., `X8664Processor`, `ARM64Processor`), with functionality added via Objective-C categories (such as `Searchers64` for binary search and `List64Utils` for linked list operations). The GUI is built with Cocoa/AppKit and follows an MVC pattern, with `AppController` managing the user interface and workflow. The CLI shares the same core processing logic but uses a separate controller for argument parsing. Preferences are managed via a synchronized system of user default keys between Objective-C and Swift components. Key reusable components include a custom endianness swap utility (`MachOSwap.h`) that replaces deprecated Apple functions, a smooth view animation helper (`SmoothViewAnimation`) for polished UI transitions, a drag-and-drop file handler (`DropBox`), and utility categories for linked list operations and binary search. The project demonstrates solid engineering practices but shows signs of technical drift through conditional compilation for obsolete macOS versions (Tiger, Leopard, Snow Leopard), though modern builds target macOS 12+.

vivisect is a comprehensive reverse engineering framework providing static analysis, dynamic debugging, emulation, and symbolic execution capabilities. It consists of several core packages: `envi` (multi-architecture disassemblers, emulators, memory abstraction), `vivisect` (workspace-based static analysis with analysis passes, import emulation, symbolic execution engine), `vtrace` (cross-platform debugging with ptrace/GDB stub support), `vdb` (debugger CLI and Qt GUI), `vstruct` (declarative binary structure parsing for formats like PE, ELF, Mach-O, minidump), `visgraph` (graph layout for control flow and call graphs), and `cobra` (custom RPC framework for remote collaboration). The system can parse and analyze PE, ELF, Mach-O, and other formats; perform function detection, control-flow recovery, switch-case identification, pointer analysis, and symbolic path exploration. It includes a full-featured debugger with breakpoints, watchpoints, and process control, and offers a Qt GUI for interactive reverse engineering. The architecture is modular but tightly integrated; many components are reusable in isolation. The codebase shows signs of long-term evolution with some Python 2/3 drift, deprecated API usage, and incomplete migration to PyQt6, but remains actively maintained with recent commits and a substantial test suite.

This repository is a clean-room, portable reimplementation of Apple Macintosh System 7.1, targeting bare-metal x86, ARM (Raspberry Pi), and PowerPC hardware. It is a monolithic kernel that emulates the classic Mac OS Toolbox API, including subsystems such as the Event Manager, Window Manager, Menu Manager, Dialog Manager, QuickDraw, Font Manager, File Manager (HFS), and a Finder-like desktop environment. The codebase is written in C and assembly, with a hardware abstraction layer (HAL) for platform-specific drivers (USB, storage, timers, framebuffer). It boots via GRUB2 (x86) or custom bootloaders (ARM, PPC) and includes built-in applications like SimpleText and MacPaint. The project is explicitly a reverse-engineering effort based on public documentation and ROM analysis, with many subsystems partially implemented or stubbed. It is not production-ready but demonstrates deep knowledge of Mac OS internals and provides a foundation for running classic Mac software on modern hardware.

de4py is a comprehensive Python deobfuscation and reverse engineering tool designed primarily for Windows environments. It combines a native PySide6 GUI with a CLI interface to analyze, unpack, and clean obfuscated Python scripts and PyInstaller executables. The core functionality relies on a modular engine architecture that supports multiple deobfuscation strategies, including legacy regex-based detection and the newer 'Onyx' engine which utilizes AST manipulation and local LLM integration for semantic recovery. It also features native C++ components for process injection and behavior monitoring, allowing users to hook into running Python processes for dynamic analysis. The architecture is split between high-level Python logic for AST transformation and low-level C++ code for system interaction. The Python side manages the deobfuscation pipeline, UI rendering, and plugin management, while the C++ side handles DLL injection, API hooking via Detours, and named pipe communication. This hybrid approach provides powerful capabilities but introduces significant platform coupling and dependency on specific Windows APIs and Python versions. The tool is licensed under CC BY-NC-4.0, restricting commercial use. While the codebase demonstrates sophisticated engineering in areas like VM lifting and AST optimization, it carries risks associated with external API dependencies (telemetry, updates), brittle regex signatures for obfuscation detection, and heavy reliance on Windows-specific system calls. It is best suited for security researchers and malware analysts working in Windows environments who require a unified static and dynamic analysis platform.